This vulnerability in Tangible Loops & Logic allows attackers to store malicious scripts in plugin input fields because the data is not properly neutralized before rendering on web pages. Stored cross‑site scripting means that the payload remains in the database and is executed each time the page is viewed, enabling client‑side code execution in visitors' browsers. The weakness is a classic input‑validation flaw (CWE‑79).

WordPress sites that have the Loops & Logic plugin installed from its initial release through version 4.2.3. Any site using these versions can store and serve malicious script payloads via the plugin's input mechanisms.

The CVSS score of 6.5 indicates moderate severity. The EPSS score of less than 1% suggests that the vulnerability has historically been exploited with very low frequency, and it is not listed in CISA’s KEV catalog. The likely attack vector is the plugin’s interfaces, which is then rendered unfiltered on the front end, allowing attackers to inject scripts that will run in users’ browsers. The risk largely depends on the presence of exposed administrative interfaces and the level of public traffic to affected pages.